As electronically-stored information (ESI) has become the norm, as computers and mobile devices have proliferated, and as eDiscovery tools have multiplied, competence with technology has become an essential part of being an effective legal practitioner. Since 2012, that practical requirement has been slowly becoming a formal one.
The broad scope of collection is broken down into the legal scope and the technological scope. The practical scope of ESI collection is determined both by the actual requests from other parties and by your own information needs related to the matter. The maximum-possible scope is established by the FRCP or your state’s equivalent ruleset. The technological scope is summarized in that nothing can be overlooked based purely on its file format or source type. Read to learn details on both the scopes.
Learn how computers store ESI by looking at the tiers and types of memory and how they all work together to store different types of data in different places. As the computer or device operates, there is a constant flow of information being read from and written to hard drive storage, RAM, and the caches – all ESI and all potential evidence. Devices are managing a collection of thousands of discrete files that is constantly evolving as files are read, modified, written, and deleted.
Learn about collecting and recovering ESI from computer memory with the difference between physical collections and logical collections, recovering deleted files, preventing data alteration and verifying the accuracy of the collection. Verifying the accuracy of collection is as important as avoiding source alteration.
We review the intersection of the legal requirements of collection and the technical process of data collection in part 5 of our collection series. The ultimate goal of evidence collection is the eventual use of some of that evidence in court, whether by you or another party. The admissibility of a particular piece of evidence at trial turns on a variety of factors, including its relevance, its potential for prejudice, its status as hearsay, etc.
Self-collection refers to a collection approach in which the custodians themselves undertake the identification and collection of relevant documents from their own materials. This approach may be a reasonable choice in certain narrow circumstances, but in most common eDiscovery situations, the numerous, large downstream risks associated with it dwarf the small, up-front cost savings you might realize.
In-person collections are the most traditional approach, and they typically involve sending the professional to the custodians and their devices. When custodians are too numerous or distributed, remote collections can be performed, most often by using shipped drives and administration over the internet.
Most cases involve collection from a range of sources beyond individual custodians’ computers, which can entail unique complications. The other major categories of sources are: enterprise systems, mobile devices, social media sources, and cloud sources.